4 ms·
Wasn't Heartbleed due to exactly that - using their own local allocator instead of calling malloc/free?
by kayamon 11y ago
Wasn't Heartbleed due to exactly that - using their own local allocator instead of calling malloc/free?
- ikeboy 11y agoHeartbleed was due to not checking the bounds. https://www.openssl.org/news/secadv_20140407.txt https://www.openssl.org/news/secadv_20140407.txt https://xkcd.com/1354/ https://xkcd.com/1354/
- thaumaturgy 11y agoPartly. They were using their own allocator (openssl_malloc()), but even then they would've been OK if it weren't for the OBO error elsewhere in the heartbeat implementation. If they were using an OS-supplied malloc() instead of openssl_malloc(), the bug would've still been exploitable on some operating systems, but not others. Either way, "don't write your own allocator" is a good lesson to learn. Unless, of course, you're doing it for fun. In which case, efficient heap management really is a neat exercise.